MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d008c984b764b8434a318537498fed636330534b0fc49caf8206e752f99a588b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d008c984b764b8434a318537498fed636330534b0fc49caf8206e752f99a588b
SHA3-384 hash: e3f2df8ad48331046b876124aa57162b5ad99a93810015575bfaa8f99b490d032fd37a0cedc6b52c227792314cad6588
SHA1 hash: 9c6758ec06350f3465c849a0d5297c71b445282e
MD5 hash: 274126369a33d41ae314e8a9303c8d5a
humanhash: rugby-maine-princess-maine
File name:Dlya sverki 13.07.2020.001
Download: download sample
Signature Pony
Create hunting rule
File size:113'635 bytes
First seen:2020-08-13 10:43:16 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:0otpYr8XzQi+ymByc97CdAzf44HxTJYQg3:0otpjXM0mBycgSEoxTHq
TLSH 2FB312E9EA65329DFA625EF4C212D30FE5644AF3A8CDD8A34017670A06E90E56DE04F1
Reporter abuse_ch
Tags:001 Pony


Avatar
abuse_ch
Malspam distributing Pony:

HELO: neruo.nerungri.edu.ru
Sending IP: 79.133.68.53
From: Елена Симонова <gym@nerungri.edu.ru>
Reply-To: Елена Симонова <tarasovaek69@rambler.ru>
Attachment: Dlya sverki 13.07.2020.001 (contains "Dlya sverki 13.07.2020.exe")

Pony C2:
http://67.205.148.45/viewtopic.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
887
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d008c984b764b8434a318537498fed636330534b0fc49caf8206e752f99a588b/
Threat name:
Win32.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 10:45:05 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2aemtbfxms4egsrrqu3utd7nmnrtau2lb7cjzl4ca3tvf6m2lcfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d008c984b764b8434a318537498fed636330534b0fc49caf8206e752f99a588b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

rar d008c984b764b8434a318537498fed636330534b0fc49caf8206e752f99a588b

(this sample)

Pony

Executable exe a4923677e96515d7fc80fad3a4d602650b5b2c5159bd0a1a49ab54b77c80e0d5

  
Dropping
MD5 8ab4319a009e5a381ea2c88421632ea4
  
Dropping
Pony
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a4923677e96515d7fc80fad3a4d602650b5b2c5159bd0a1a49ab54b77c80e0d5

Comments